UnCanny Coercion - InstallServicePlugin Loaded from UNC

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•5

Detects InstallService.exe loading the InstallServicePlugin.dll from a remote UNC path. This behavior is associated with the UnCanny Coercion technique, which exploits a vulnerability in the Windows Installer service to load arbitrary DLLs from remote shares.